CVE-2022-48926
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2022-48926
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-48926.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2022-48926
- Downstream
- Related
- Published
- 2024-08-22T04:15:15Z
- Modified
- 2025-07-01T14:22:52.879883Z
- Severity
-
- 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- [none]
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: rndis: add spinlock for rndis response list
There's no lock for rndis response list. It could cause list corruption if there're two different listadd at the same time like below. It's better to add in rndisaddresponse / rndisfreeresponse / rndisgetnextresponse to prevent any race condition on response list.
[ 361.894299] [1: irq/191-dwc3:16979] list_add corruption. next->prev should be prev (ffffff80651764d0), but was ffffff883dc36f80. (next=ffffff80651764d0).
[ 361.904380] [1: irq/191-dwc3:16979] Call trace: [ 361.904391] [1: irq/191-dwc3:16979] _listaddvalid+0x74/0x90 [ 361.904401] [1: irq/191-dwc3:16979] rndismsgparser+0x168/0x8c0 [ 361.904409] [1: irq/191-dwc3:16979] rndiscommandcomplete+0x24/0x84 [ 361.904417] [1: irq/191-dwc3:16979] usbgadgetgivebackrequest+0x20/0xe4 [ 361.904426] [1: irq/191-dwc3:16979] dwc3gadgetgiveback+0x44/0x60 [ 361.904434] [1: irq/191-dwc3:16979] dwc3ep0completedata+0x1e8/0x3a0 [ 361.904442] [1: irq/191-dwc3:16979] dwc3ep0interrupt+0x29c/0x3dc [ 361.904450] [1: irq/191-dwc3:16979] dwc3processevententry+0x78/0x6cc [ 361.904457] [1: irq/191-dwc3:16979] dwc3processeventbuf+0xa0/0x1ec [ 361.904465] [1: irq/191-dwc3:16979] dwc3thread_interrupt+0x34/0x5c
- References
-
- https://git.kernel.org/stable/c/33222d1571d7ce8c1c75f6b488f38968fa93d2d9
- https://git.kernel.org/stable/c/4ce247af3f30078d5b97554f1ae6200a0222c15a
- https://git.kernel.org/stable/c/669c2b178956718407af5631ccbc61c24413f038
- https://git.kernel.org/stable/c/9ab652d41deab49848673c3dadb57ad338485376
- https://git.kernel.org/stable/c/9f5d8ba538ef81cd86ea587ca3f8c77e26bea405
- https://git.kernel.org/stable/c/9f688aadede6b862a0a898792b1a35421c93636f
- https://git.kernel.org/stable/c/aaaba1c86d04dac8e49bf508b492f81506257da3
- https://git.kernel.org/stable/c/da514063440b53a27309a4528b726f92c3cfe56f
- https://security-tracker.debian.org/tracker/CVE-2022-48926
Affected packages
Debian:11 / linux
Package
- Name
- linux
- Purl
- pkg:deb/debian/linux?arch=source
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed5.10.103-1
Debian:12 / linux
Package
- Name
- linux
- Purl
- pkg:deb/debian/linux?arch=source
Debian:13 / linux
Package
- Name
- linux
- Purl
- pkg:deb/debian/linux?arch=source